Remote: PC Tips by Anu

Showing posts with label Remote. Show all posts

Saturday, January 21, 2012

Microsoft Windows Remote Code Execution

Saturday, January 21, 2012

Anu

Friday, December 17, 2010

How to crack Unix & Linux password files?

Friday, December 17, 2010

Anu

This tutorial is sended by our Guest Member <"Signal Sender" signalsender@gmail.com

If you want to do any MS Terminal Server cracking you basically haveyour choice of three tools that can do it for you; TSgrinder, TScrack,and a patched version of RDesktop. This article takes you step-by-step through the concepts, tools and usage.

TSGrinder is readily available from http://www.hammerofgod.com/download.html.
TSCrack you’ll have to google for as it is not readily available anymore.
Rdesktop v1.41 can be downloaded from http://www.rdesktop.org/ and you’ll need the patch from foofus.net http://www.foofus.net/jmk/rdesktop.html.

Part 1: MS Terminal Services Overview

Hacking Exposed Windows Server 2003 goes a great overview, I won’tplagiarize it all here, so check it out for me details and thereferences section of this paper for some MS references.
Prior to Terminal Services, Windows did not provide the ability to runcode remotely in the processor space of the server. Another way to putthis is there was no way to have an “interactive” session on theserver. There were tools like wsremote or psexec or VNC. If an attackergot a non administrator level account on a remote machine they couldmap shares and copy files but had a difficult time running code on theserver. Now, with Terminal Services, an attacker can log on as a nonprivileged user and run exploit local exploit code via the TerminalServices GUI. These attacks used to be fairly limited to local physicalattacks or from users who actually logging into your domain but now ifthe server has Terminal Services (2000 server 2003 server) or RDP(Windows XP) running the attack vector increases.
Terminal Services by default listen on port 3389 (but can be changed by editing the registry).
If you want to change the listening port, edit this registry key:
\HKLM\System\CurrentControlSet\Control\Terminal Server\WinStationRDP-TCP Value : PortNUmber REG_DWORD=3389
To turn on Terminal Server/RDP, edit this registry key (or to turn it on via command line):
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0
With this command you can enable the RDP Service.

Password Cracking Basics

There are three types of password attacks:
Brute Force: A cryptanalysis technique or other kind of attackmethod involving an exhaustive procedure that tries all possibilities,one-by-one. [1] For example, the program might follow a sequence likethis:
"aaaaaaaa"
"aaaaaaab"
"aaaaaaac" ...
Until the password is found

Dictionary Attack: An attack that tries all of the phrases orwords in a dictionary, trying to crack a password or key. A dictionaryattack uses a predefined list of words compared to a brute force attackthat tries all possible combinations. [2]

Hybrid Attack: A hybrid attack is a mixture of a brute forceattach and a dictionary attack. There are many different ways a hybridattack can be performed, in it's simplest form a hybrid attack maysimply add a couple of numbers to the end of each dictionary wordtried, this increases the number of tested combinations without havingto resort to a true brute force attack. Cracking software will oftenuse a combination or selection of all three methods to try and guessyour password. [3]

Terminal Services Enumeration

You can google for “/TSWeb/default.htm”

Figure 1.1: Output of a google search for /TSWeb/default.htm
You can nmap for port 3389

Figure 1.2: A Nmap scan looking for port 3389 open on the Class C.

Figure 1.3: Results on the Nmap Scan looking for open port 3389.
You can use ProbeTS (http://www.ziddu.com/download/13010137/probets.zip.html):

Figure 1.4: The output of probeTS.

Terminal Services Connections

Let’s see what a regular Terminal Services connection looks like.

Figure 1.5: the Terminal Services/RDP Client on Windows 2000 Pro to a Windows 2000 Terminal Server.

Figure 1.6: Issuing a command over the Terminal Services Client.

Part 2: TSGrinder

From the TSGrinder website:
“TSGrinder is the first production Terminal Server bruteforce tool. Themain idea here is that the Administrator account, since it cannot belocked out for local logons, can be brute forced. Also having anencrypted channel to the TS logon process sure helps to keep IDS fromcatching the attempts.
TSGrinder is a "dictionary" based attack tool, but it does have someinteresting features like "l337" conversion, and supports multipleattack windows from a single dictionary file. It supports multiplepassword attempts in the same connection, and allows you to specify howmany times to try a username/password combination within a particularconnection.
Also, the problem you describe can be exacerbated in that administratoraccount can be brute-forced without creating a log entry, by attempting5 logons and disconnecting before Windows disconnects and logs afterthe sixth failure.”
Let’s see TSGrinder in action. I had to use the Windows XP RDP clienton Windows2000 SP4 to get TSGrinder to work properly. I did not needroboclient.zip that it mentions on the website.

Figure 2.1: TSGrinder being run with no arguments.

Figure 2.2: TSGrinder using a dictionary attack against the administrator account.

Figure 2.3: A failed attempt.

Figure 2.4: if TSGrinder guesses the password it will log into the terminal services and immediately disconnect.

Figure 2.5: A successful attempt with TSGrinder.

Figure 2.6: TSGrinder supports 2 threads. Here you can see two threads running the attack.

Figure 2.7: A successful attempt with TSGrinder that used 2 threads to run the attack.

Part 3: TScrack

From the TScrack documentation:
“The Windows Terminal Services facility offers graphical desktopsessions to remote clients. Terminal Services enables users to work ina windows session that exists on the server. The client functionalityis basically reduced to the functionality of a terminal, all it does isdisplay the session screen, and collect user input.
TScrack applies AI technology (Artificial Neural Networks) to scrapethe screen contents of the graphical logon, in order to enable a simpledictionary based cracking algorithm to perform efficiently against thegraphically presented logon dialogs and message boxes.
This is very similar to the technology used i.e. in Optical CharacterRecognition (OCR), Face- and Image recognition in general.
TScrack was written for two purposes:
a) To provide a tool to assess password security of MS RDP servers
b) As proof of concept code, to point out that graphical logons are byno means secure from automated cracking / password guessing tools

Figure 3.1: TScrack being run with no arguments.

Figure 3.2: TScrack being run against a Windows Server 2003 Terminal Server

Figure 3.3: TScrack successfully cracking the password

Figure 3.4: TScrack also does multithreading cracking, use the –t option for 2 connections

Figure 3.5: TScrack with two simultaneous connections running

Figure 3.6: TScrack successfully cracking the password
TScrack was updated to v2.1 to include brute force attacks (something TSGrinder does not do).

Figure 3.7: TScrack in Brute force mode (-B option & max word length of 6)
**Note 1: I attempted to use the –N (no logging option). WindowsServer 2003 still logged every failed attempt to log on (which isgood).

Figure 3.8: TScrack in Brute force mode with the –N (no logging) option

Figure 3.9: Even with –N enabled Windows Server 2003 logged theattempts. I did not test every configuration on every type of OS, Ijust noticed it was logging the attempt and shared the info.
**Note 2: I also had to drastically change the default password policyon Server 2003 to put an easy to crack password. I chose a password of“chrisg” as the password I wanted to brute force.

Figure 3.10: Here is the default password policy for Windows Server 2003

Figure 3.11: What I changed the password policy to, to allow “chrisg” as a password
**Note 3: I had to run TScrack 2.1 on windows 2000 machine; it wasn’tworking properly on Windows XP SP2. Also, If you are getting aMSRDP.OCX error, then uninstall TScrack using the “-U” option thenreinstalling by issuing TScrack.exe –h.

Part 4: Rdesktop & BruteForcing RDP with Rdesktop patch

Download rdesktop version 1.41 from the website:
http://www.rdesktop.org/%20
http://prdownloads.sourceforge.net/rdesktop/rdesktop-1.4.1.tar.gz?download%20
Download the rdp-bruteforce patch from foofus.net:
http://www.foofus.net/jmk/rdesktop.html%20
http://www.foofus.net/jmk/tools/rdp-brute-force-r422.diff%20
Paste the patch into the source directory and apply the patch
SegFault:/Users/chrisgates/Desktop root# cd rdesktop-1.4.1
SegFault:/Users/chrisgates/Desktop/rdesktop-1.4.1 root# patch -p1 -i rdp-brute-force-r422.diff
patching file orders.c
patching file orders.h
patching file rdesktop.c
patching file rdesktop.h
patching file rdp.c
patching file secure.c
patching file xkeymap.c
compile and install rdesktop:
./configure
make
sudo make install
Start X-Windows/X-Darwin/X11(I used X-Darwin installed using fink usingMac OS X Tiger). Shouldn’t be an issue if you are using an linux flavorwith a GUI.
Now start Rdesktop with your passlist and user or userlist:
SegFault:~/Desktop/rdesktop-1.4.1 chrisgates$ rdesktop -u administrator -p pass.txt 192.168.0.105
**you'll need to run this from X-Darwin/X-Windows/X-11, if you run it from the command line it will say something like:
ERROR: Failed to open display:
If everything is working right you'll see it opening the Rdesktoptrying to log in and then exiting. Check your command line output tosee if you were able to guess the password.

Figure 4.1: Running Rdesktop with no parameters gives you the help menu.

Figure 4.2: Issuing the command line parameters to start Rdestop in *nix in XDarwin.

Figure 4.3: Rdestop brute forcing the accounts.
The following output was against an XP Pro SP2 host. With XP if theuser is currently logged in, they will be forced to log off if youconnect to the machine over RDP.
SegFault:~/Desktop/rdesktop-1.4.1 chrisgates$ rdesktop -u noone -p pass.txt 192.168.0.105
Starting dictionary attack against server 192.168.0.105
-------------------------------------------------------
Retrieved connection termination packet.
Account credentials are NOT valid.
Retrieved connection termination packet.
[failure] User "noone" Password "test"
Retrieved connection termination packet.
Account credentials are NOT valid.
Retrieved connection termination packet.
---SNIP---
[failure] User "noone" Password "admin"
Retrieved connection termination packet.
Account credentials are NOT valid.
Retrieved connection termination packet.
[failure] User "noone" Password "administrator"
Valid credentials, however, another user is currently logged on.
[success] User "noone" Password "noone"
SegFault:~/Desktop/rdesktop-1.4.1 chrisgates$

Figure 4.4: The command line output of the successful attack against XP SP2 but with the user logged in.
Let’s see Rdesktop against a Windows Server 2003.

Figure 4.5: Rdesktop against Windows Server 2003 against the “chris” account.

Figure 4.6: Rdesktop successfully cracking the password with a dictionary attack.

Thanks to Signal Sender...

Monday, November 8, 2010

Hackers vulnerabilities of $3195, just for free...

Monday, November 08, 2010

Anu

As many as 70% of web sites have vulnerabilities that could lead to thetheft of sensitive corporate data such as credit card information andcustomer lists.

Hackers are concentrating their efforts onweb-based applications - shopping carts, forms, login pages, dynamiccontent, etc. Accessible 24/7 from anywhere in the world, insecure webapplications provide easy access to backend corporate databases.

Firewalls, SSL and locked-down servers are futile against web application hacking!

DOWNLOAD LINK

Webapplication attacks, launched on port 80/443, go straight through thefirewall, past operating system and network level security, and rightin to the heart of your application and corporate data. Tailor-made webapplications are often insufficiently tested, have undiscoveredvulnerabilities and are therefore easy prey for hackers.

Acunetix - a world-wide leader in web application security

Acunetixhas pioneered the web application security scanning technology: Itsengineers have focused on web security as early as 1997 and developedan engineering lead in web site analysis and vulnerability detection.

Acunetix Web Vulnerability Scanner includes many innovative features:

AcuSensor Technology
An automatic client script analyzer allowing for security testing of Ajax and Web 2.0 applications
Industries' most advanced and in-depth SQL injection and Cross site scripting testing
Advanced penetration testing tools, such as the HTTP Editor and the HTTP Fuzzer
Visual macro recorder makes testing web forms and password protected areas easy
Extensive reporting facilities including VISA PCI compliance reports
Multi-threaded and lightning fast scanner crawls hundreds of thousands of pages with ease
Intelligent crawler detects web server type and application language
Acunetix crawls and analyzes websites including flash content, SOAP and AJAX
Port scans a web server and runs security checks against network services running on the server

Acunetixcan be used to fully determine if a website is vulnerable in any way,and it rates the security risk level. It can scan for all the attacksmentioned above to see what its vulnerable, or find allot of usefulinfo about the site as given.

Thistool can be used by both white hats and black hats. It worths 3195$ for1 year!!! I am giving it for free and unlimited time. That's a hell alot of money.